Download the PHP package sandermuller/richter without Composer

Richter

Measures the magnitude of impact of code changes in a Laravel codebase. Like the Richter scale, but for your PHP.

Run php artisan richter:detect-changes on a branch and Richter reports the HTTP and CLI entry points the diff can reach, flags the ones no test references, and attaches a coarse advisory risk level. Review then starts from what the change reaches, instead of from a cold diff.

What makes it worth installing:

• Member-level change impact. A one-method change seeds that method in the code graph, not the whole class. The graph covers routes, controllers, jobs, listeners, policies, resources, Blade views, and the Eloquent relations your code walks, plus edges a route-anchored analysis misses.
• Honest degradation. A change the graph cannot place reads UNRESOLVED, never a falsely reassuring "no impact". A coverage gap costs reach, but it never causes anything to be reported as unaffected.
• Test-coverage prompts. Every reached entry point is tagged [test-referenced] or [⚠ no test references this], a heuristic prompt rather than a coverage verdict.
• Blast radius and traces on demand. richter:impact lists a symbol's callers, its dependencies, and the entry surfaces behind them. richter:trace answers "how does this even reach that?" with the shortest call chain.
• Affected-test selection. richter:affected-tests turns the diff's reach into a test selection, with an exit-code contract that fails toward running the full suite whenever the selection cannot be trusted.
• Built for coding agents. Richter registers a local MCP server exposing every analysis read-only, so an agent can work with the graph mid-review without shelling out. The --markdown report is ready to post as a pull-request comment.

Richter is advisory by default: richter:detect-changes exits 0, and a low or empty result is a signal, not a guarantee of no impact. Opt into a CI gate with --fail-on / --fail-on-unresolved.

The analysis is static, built on Laravel Brain, and fast enough to run on every branch: it never executes your application's routes, jobs, or commands. It does, however, autoload classes from the analyzed checkout, and autoloading runs a file's top-level code. Treat a checkout you would not composer install on as one you should not analyze either.

Installation

Requires PHP 8.4+ and Laravel 12 or 13. laravel/mcp is optional and, when present, must fall in the supported ^0.8||^0.9 range; see Installation for the laravel/boost v1 case.

Richter is accurate only once it knows your app's shape. Ask your agent to "set up Richter", or follow Set up your project.

Usage

Each of these takes --json for machine-readable output. richter:detect-changes also takes --html=<path> for a self-contained visual report.

Documentation

Read the full documentation at sandermuller.github.io/richter.

Getting started

• Why Richter? — what a report tells you, what it refuses to guess at, and how the analysis runs
• Installation — requirements, the laravel/mcp constraint, publishing the config
• Set up your project — the setup skill, or two prompts you can paste to any agent

Change impact

• Detecting change impact — the main command, which diff is analysed, reading the report, --explain
• Report annotations — security exposure, Pennant gates, payload parity, middleware group membership
• Output formats — --markdown, --html, and the --json contract
• Risk levels — how the level is decided, calibrating the thresholds, the scored counts
• Gating in CI — --fail-on, --fail-on-unresolved, and a pull-request workflow

Commands

• Blast radius of a symbol — richter:impact
• Shortest path between symbols — richter:trace
• Affected-test selection — richter:affected-tests

Digging deeper

• Frontend changes — the Wayfinder/Ziggy bridge in full
• MCP server — the read-only tools and resources an agent can call
• Graph cache — the fingerprinted cache, profiling, scoped rebuilds
• Coverage beyond Laravel Brain — the edges a route-anchored analysis misses, and the known limits

Reference

• Configuration reference — every key in config/richter.php
• Benchmarking — scoring accuracy against replayable history
• Troubleshooting — a symptom index: empty reports, UNRESOLVED files, saturated risk levels, exit 2

Testing

composer qa is the auto-fixing variant: it rewrites the working tree (Rector, Pint), so use qa-check when you only want to verify.

Changelog

See CHANGELOG for what changed per release.

Security

Found a vulnerability? Don't open an issue; see SECURITY for where to send it.

License

MIT. See LICENSE.